4 ms·
On the topic of security, I am surprised there aren’t more safeguards for marketplace actions. I work in a larger organization and see that folks very much want
by cebert 5y ago
On the topic of security, I am surprised there aren’t more safeguards for marketplace actions. I work in a larger organization and see that folks very much want to pull in actions that solve an immediate need without any type of vetting process. These actions are part of your build pipeline and can pose a substantial security threat.
Dependabot does not currently scan for outdated or vulnerable marketplace actions. It’s difficult for Enterprise Orgs to ensure only vetted actions are used. I think this area of GitHub is ripe for security and governance improvements.
- newman314 5y agoSo if you are concerned about this, I'd suggest looking at the following: * OpenSSF Scorecard Action - https://github.com/ossf/scorecard#scorecards-github-action https://github.com/ossf/scorecard#scorecards-github-action * Step Security Harden Action - https://github.com/step-security/harden-runner https://github.com/step-security/harden-runner I realize that this means trusting these providers but they seem at least tacitly blessed by GitHub. https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions https://docs.github.com/en/actions/security-guides/security-...
- cebert 5y agoThanks, those are great resources!
- twistedpair 5y ago> It’s difficult for Enterprise Orgs to ensure only vetted actions are used. You can already to this 1. Visit Settings > Actions > General Actions Permissions > Policies 2. Select "Allow non-org actions and reusable workflows" You can then allow GitHub authored actions, verified publish actions, and OR provide an explicit allow list of actions.
- onionisafruit 5y agoI maintain a somewhat popular action and advise people to specify a commit if they use my action, but they want to just depend on v1 and trust me to never screw up. They don’t know me. Why do they think I’m not going to sell out to the first person who offers me a six pack to merge their code?